Why governance, operational discipline and business understanding must evolve together
By Errol Rodericks, Product & Solutions Marketing Director at Denodo and Dr Paul Dongha PhD, Head of Responsible AI and AI Strategy at NatWest Group, and author of ‘Governing the Machine: How to Navigate the Risks of AI and Unlock its True Potential’
Financial institutions have spent the past few years asking what AI can do. The more important question is rapidly becoming: what happens when we allow it to decide?
An AI system can be built on a powerful model. It can be secure, governed, resilient, observable and scalable. And it can still make the wrong business decision.
The problem may not be the model. It may not even be the data.
The AI may simply not understand enough about the business situation in which it is being asked to act.
That matters because AI is moving from answering questions to influencing decisions and even taking actions.
A wrong answer is a problem. A wrong action can be a business event.
For financial institutions, that changes the Enterprise AI conversation.
From our different perspectives across responsible AI and governance, operationalising AI at enterprise scale, and the business understanding AI needs to make better decisions, we see a common challenge emerging. Trusted Enterprise AI depends on these capabilities developing together.
For financial institutions this comes down to a set of connected questions. Can we govern AI effectively? Can we operationalise it? And crucially, does it understand the business well enough to act appropriately?
Can we govern it?
Financial services has always operated within boundaries.
A decision isn’t appropriate simply because it is mathematically possible or commercially attractive. It must also comply with policies, regulations, risk thresholds, permissions, customer obligations and organisational controls.
The same applies to AI.
As AI increasingly affects customers, financial performance, risk, compliance and reputation, governance cannot remain solely a technology responsibility. Boards and senior executives need visibility into where AI is being used, what decisions it influences, what risks those decisions create and who is accountable for the outcomes.
But there is a further dimension as AI becomes more autonomous.
Much of the responsible AI discussion has understandably focused on putting governance around AI: policies, oversight, risk frameworks, audit processes and controls.
Those remain essential. But increasingly, elements of governance also need to become part of what AI understands.
An AI system may need to know what it is permitted to do, which policy applies to a particular customer or transaction, who has authority to approve an action, where information is permitted to reside and when human intervention is required.
Governance therefore isn’t only about constraining AI from the outside. Increasingly, it also provides context for the decisions AI makes.
And governance only becomes meaningful at enterprise scale when policies and controls can be operationalised consistently across models, applications and agents.
Can we operationalise it?
Creating an impressive AI proof of concept is one thing. Operating AI reliably across a bank, insurer or other financial institution is something else entirely.
Enterprise AI requires much more than access to a foundation model. It needs AI-ready architecture, governed and accessible data, security and identity controls, repeatable deployment, observability, evaluation and resilient infrastructure. Organisations also need the skills and operating models to manage AI as an ongoing enterprise capability rather than a succession of experiments.
Agentic AI raises the stakes further.
An AI assistant may generate a recommendation for a person to consider. An autonomous agent may invoke tools, interact with systems, orchestrate workflows and take action.
The greater the autonomy, the greater the need for identity, permissions, observability, evaluation, resilience and appropriate human oversight.
But operationalisation also intersects with understanding.
Imagine an AI agent making a decision at 14:37 based on information extracted into a central repository the previous evening.
The information may have been completely accurate when it was extracted. But since then, a customer may have made a payment, a fraud alert may have been resolved, a claim approved, a policy changed or a treasury team may have authorised a transaction.
The AI may therefore have excellent historical information while lacking the current operational state of the business.
Context that isn’t operationally available at the moment AI needs it isn’t useful context.
For Enterprise AI, freshness and accessibility are therefore not merely technical considerations. They can directly affect the quality of the business decision.
Does it understand the business?
Even current, accurate information may not be enough.
Consider a high-value international transaction. The amount is unusual. The destination is unusual. Multiple risk indicators are triggered, and an AI fraud system flags it.
The model may be behaving exactly as designed.
What it doesn’t know is that the transaction has already been approved by the institution’s treasury function.
The data isn’t wrong. The model isn’t necessarily wrong. The AI’s understanding of the situation is incomplete.
Now imagine that instead of generating an alert for an employee to investigate, an autonomous agent is authorised to act on that assessment.
The distinction between intelligence and understanding suddenly becomes commercially significant.
The same problem can arise in everyday customer interactions. An unusual card transaction might look fraudulent until the AI understands that the customer is travelling abroad. In both cases, the underlying data can be correct. What changes the decision is context.
This is why simply giving AI access to more data is not the same as giving it a better understanding of the business.
AI also needs meaning, relationships, policies, governance and current operational conditions. It needs to know how different pieces of information relate, which sources are authoritative and what is happening at the point a decision is being made.
We think of this as Active Context: bringing together trusted information with metadata, semantics, business relationships, governance and current operational state so that AI can interpret information within the circumstances in which a decision occurs.
The objective isn’t simply more information. It is better situational understanding.
From centralised data to connected knowledge
This requirement also has implications for enterprise data architecture.
Financial institutions have invested heavily in warehouses, lakehouses, cloud platforms and modern data architectures. Those investments remain important.
But the information AI needs rarely resides in one place. It can sit across core banking and insurance systems, CRM, payment and fraud platforms, documents, legacy systems and modern data platforms. Relevant information may also come from outside the institution, including partners, regulators and external data providers.
The architectural challenge is therefore not simply how to centralise ever more data for AI. It is how to give AI governed access to the trusted information and context it needs, wherever that information resides.
That points towards a logical, governed data layer for AI, capable of connecting distributed information and providing the semantics, policies, relationships and operational context AI needs without requiring another round of wholesale data centralisation.
This also makes secure data sharing increasingly important.
AI may need information from multiple organisations to understand a situation properly. But sharing cannot mean surrendering control. Security, access, ownership, sovereignty and regulatory obligations still need to be enforced.
The future of Enterprise AI isn’t simply about centralising more data. It is about securely connecting trusted knowledge.
The three questions are really one
Governance, operationalisation and business understanding are often treated as separate AI workstreams.
Increasingly, they are inseparable.
If an AI agent needs to know whether it is permitted to execute a transaction, governance becomes part of the context for that decision. If it needs to understand a customer’s current situation, that context must be available at the moment the decision occurs. Access to information alone is not enough if AI cannot interpret the relationships between the customer, transaction, policy and organisational rules.
Governance without operationalisation risks remaining policy on paper. Operationalisation without governance creates capability without sufficient control. And both can be present while AI still makes an inappropriate decision because it lacks sufficient understanding of the situation.
As autonomy increases, none of the three can be treated in isolation.
Ultimately, ROI is about what happens next.
This also changes how financial institutions should think about AI economics.
Token consumption, GPU utilisation, infrastructure cost, latency and model performance all matter. But they primarily tell us how efficiently AI operates.
They don’t necessarily tell us whether AI is improving the business.
The more important questions are different. Did we make a better lending decision? Did we identify fraud more accurately? Did we reduce false positives? Did we resolve the customer’s problem faster? Did we lower operational risk? Did we automate a process without compromising trust?
In other words, did AI produce a better business outcome?
Governance provides appropriate boundaries. Operationalisation makes trusted AI capabilities available at scale. Business understanding enables better judgement. Better judgement enables better decisions. Better decisions enable better actions. And better actions create better business outcomes.
Reducing the cost of AI matters.
But reducing the cost of generating a decision is not the same as increasing the value of that decision.
The greater economic opportunity lies in improving what the business does as a consequence of AI.
The question is changing
The next era of AI in financial services will not be won simply by deploying more powerful models.
It will be shaped by institutions that can give AI the authority to operate within appropriate boundaries, the operational capability to perform reliably at scale, and the business understanding to know what the right action actually is.
As AI moves from assisting people to acting on their behalf, these capabilities become inseparable.
For financial-services leaders, the question is no longer simply what their AI can do.It is whether it understands the business well enough for them to trust what it does next.
Continue the discussion
These questions are explored in greater depth in a webinar featuring Dr Paul Dongha, Errol Rodericks and Jyoti Edacherry, Cloud Operations Architect – Global Financial Services at AWS, bringing together perspectives on responsible AI and governance, operationalising Enterprise AI at scale, and the business understanding needed for increasingly consequential AI decisions.
Access the webinar here to hear the full discussion.